Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12OGdxLTVncnEtOTcyOM4AAu1-

mozjpeg DecompressScanlines::read_scanlines is Unsound

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes,
and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

• T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
• T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

Permalink: https://github.com/advisories/GHSA-v8gq-5grq-9728
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12OGdxLTVncnEtOTcyOM4AAu1-
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

Identifiers: GHSA-v8gq-5grq-9728
References:

• https://github.com/ImageOptim/mozjpeg-rust/issues/10
• https://rustsec.org/advisories/RUSTSEC-2020-0165.html
• https://github.com/advisories/GHSA-v8gq-5grq-9728

Repository: https://github.com/ImageOptim/mozjpeg-rust
Blast Radius: 0.0

Affected Packages